X-Git-Url: https://git.immae.eu/?a=blobdiff_plain;f=modules%2Fprivate%2Fmail%2Frelay.nix;h=651452c3e2b79d37c1032c05515cfdf07759ed5d;hb=22b4bd78a10b49272cfd345d379703cae4ab5d3d;hp=18d6bc39f2f98f6dbdf764d2314b1020157bddbc;hpb=ccb8bab471a25fe21caff2f66309be7dc44d3b14;p=perso%2FImmae%2FConfig%2FNix.git

diff --git a/modules/private/mail/relay.nix b/modules/private/mail/relay.nix
index 18d6bc3..651452c 100644
--- a/modules/private/mail/relay.nix
+++ b/modules/private/mail/relay.nix
@@ -1,7 +1,7 @@
 { lib, pkgs, config, nodes, name, ... }:
 {
   config = lib.mkIf config.myServices.mailBackup.enable {
-    security.acme2.certs."mail" = config.myServices.certificates.certConfig // {
+    security.acme.certs."mail" = config.myServices.certificates.certConfig // {
       postRun = ''
         systemctl restart postfix.service
         '';
@@ -27,7 +27,7 @@
           hosts = ${config.myEnv.mail.postfix.mysql.remoteHost}
           dbname = ${config.myEnv.mail.postfix.mysql.database}
           query = SELECT DISTINCT 1
-            FROM forwardings_merge
+            FROM forwardings
             WHERE
               ((regex = 1 AND '%s' REGEXP CONCAT('^',source,'$') ) OR (regex = 0 AND source = '%s'))
               AND active = 1
@@ -43,29 +43,44 @@
           '';
       }
       {
-        dest = "postfix/mysql_mailbox_maps";
+        dest = "postfix/ldap_mailboxes";
         user = config.services.postfix.user;
         group = config.services.postfix.group;
         permissions = "0440";
         text = ''
-          # We need to specify that option to trigger ssl connection
-          tls_ciphers = TLSv1.2
-          user = ${config.myEnv.mail.postfix.mysql.user}
-          password = ${config.myEnv.mail.postfix.mysql.password}
-          hosts = ${config.myEnv.mail.postfix.mysql.remoteHost}
-          dbname = ${config.myEnv.mail.postfix.mysql.database}
-          query = SELECT DISTINCT 1
-            FROM mailboxes
-            WHERE active = 1
-            AND (
-              (domain = '%d' AND user = '%u' AND regex = 0)
-              OR (
-                regex = 1
-                AND '%d' REGEXP CONCAT('^',domain,'$')
-                AND '%u' REGEXP CONCAT('^',user,'$')
-              )
+          server_host = ldaps://${config.myEnv.mail.dovecot.ldap.host}:636
+          search_base = ${config.myEnv.mail.dovecot.ldap.base}
+          query_filter = ${config.myEnv.mail.dovecot.ldap.postfix_mailbox_filter}
+          bind_dn = ${config.myEnv.mail.dovecot.ldap.dn}
+          bind_pw = ${config.myEnv.mail.dovecot.ldap.password}
+          result_attribute = immaePostfixAddress
+          result_format = dummy
+          version = 3
+        '';
+      }
+      {
+        dest = "postfix/sympa_mailbox_maps";
+        user = config.services.postfix.user;
+        group = config.services.postfix.group;
+        permissions = "0440";
+        text = ''
+          hosts = ${config.myEnv.mail.sympa.postgresql.host}
+          user = ${config.myEnv.mail.sympa.postgresql.user}
+          password = ${config.myEnv.mail.sympa.postgresql.password}
+          dbname = ${config.myEnv.mail.sympa.postgresql.database}
+          query = SELECT DISTINCT 1 FROM list_table WHERE '%s' IN (
+              CONCAT(name_list, '@', robot_list),
+              CONCAT(name_list, '-request@', robot_list),
+              CONCAT(name_list, '-editor@', robot_list),
+              CONCAT(name_list, '-unsubscribe@', robot_list),
+              CONCAT(name_list, '-owner@', robot_list),
+              CONCAT('sympa-request@', robot_list),
+              CONCAT('sympa-owner@', robot_list),
+              CONCAT('sympa@', robot_list),
+              CONCAT('listmaster@', robot_list),
+              CONCAT('bounce@', robot_list),
+              CONCAT('abuse-feedback-report@', robot_list)
             )
-            LIMIT 1
         '';
       }
       {
@@ -89,16 +104,14 @@
 
     networking.firewall.allowedTCPPorts = [ 25 ];
 
-    nixpkgs.overlays = [ (self: super: {
-      postfix = super.postfix.override { withMySQL = true; };
-    }) ];
     users.users."${config.services.postfix.user}".extraGroups = [ "keys" ];
     services.filesWatcher.postfix = {
       restart = true;
       paths = [
         config.secrets.fullPaths."postfix/mysql_alias_maps"
-        config.secrets.fullPaths."postfix/mysql_mailbox_maps"
+        config.secrets.fullPaths."postfix/sympa_mailbox_maps"
         config.secrets.fullPaths."postfix/ldap_ejabberd_users_immae_fr"
+        config.secrets.fullPaths."postfix/ldap_mailboxes"
       ];
     };
     services.postfix = {
@@ -140,12 +153,8 @@
             )
           );
         };
-        sasl_access = {
-          host_dummy_mailboxes = pkgs.writeText "host-virtual-mailbox"
-            (builtins.concatStringsSep "\n" (lib.attrsets.mapAttrsToList (n: v: "${n}@immae.eu  1") nodes));
-        };
       in
-        recipient_maps // relay_restrictions // virtual_map // sasl_access;
+        recipient_maps // relay_restrictions // virtual_map;
       config = {
         ### postfix module overrides
         readme_directory = "${pkgs.postfix}/share/postfix/doc";
@@ -183,8 +192,8 @@
             "ldap:${config.secrets.fullPaths."postfix/ldap_ejabberd_users_immae_fr"}"
           ];
           virtual_mailbox_maps = [
-            "hash:/etc/postfix/host_dummy_mailboxes"
-            "mysql:${config.secrets.fullPaths."postfix/mysql_mailbox_maps"}"
+            "ldap:${config.secrets.fullPaths."postfix/ldap_mailboxes"}"
+            "pgsql:${config.secrets.fullPaths."postfix/sympa_mailbox_maps"}"
           ];
         in
           backup_recipients ++ virtual_alias_maps ++ virtual_mailbox_maps;